You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Eric Covener <co...@gmail.com> on 2016/06/08 12:01:28 UTC
Re: [users@httpd] root perms / rewritemap prg / module system()
On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
> Then my question is, could it be possible ?
You would need your own daemon launched during an early hook (like
post_config). You wouldn't be able to respond [directly] to requests,
you'd need to reach out over something like a pipe the way rewritemap
does.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] root perms / rewritemap prg / module system()
Posted by Ben RUBSON <be...@gmail.com>.
> On 24 Jun 2016, at 16:24, Stormy <st...@stormy.ca> wrote:
>
> At 03:53 PM 6/24/2016 +0200, Ben RUBSON wrote:
>> On 2016-06-08 at 14:24, Nick Kew wrote :
>> > On Wed, 2016-06-08 at 08:01 -0400, Eric Covener wrote:
>> >> On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
>> >>> Then my question is, could it be possible ?
>> >>
>> >> You would need your own daemon launched during an early hook (like
>> >> post_config). You wouldn't be able to respond [directly] to requests,
>> >> you'd need to reach out over something like a pipe the way rewritemap
>> >> does.
>> >>
>> > A hacked suexec would be a per-request option. Or using
>> > solaris and mod_privileges might just possibly help with
>> > more fine-grained escalation.
>>
>> Nick, thank you very much for your answer, and sorry for my late reply.
>>
>> I red suexec source code, it gave me some ideas :
>> I could write my own setuid-ed program which would :
>> - setuid(<user_id>)
>> - only perform the needed tasks under <user>
>> - exit
>> This program could be then called from any other custom module etc...
>
> Maybe esoteric, possibly off-topic for this precise thread, but would mod-itk be potentially useful? I looked into it a few years back, it *seemed* to do what was promised, but also carried a fairly major cpu-cycle overhead. I didn't have time to try and refine implementation and never put it into production...
Thank you for your suggestion Paul !
I used to use mpm-itk, but I reverted back to built-in MPMs as I'm not really confident having the main server (the very first one receiving requests) running as root.
Best regards,
Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] root perms / rewritemap prg / module system()
Posted by Stormy <st...@stormy.ca>.
At 03:53 PM 6/24/2016 +0200, Ben RUBSON wrote:
>On 2016-06-08 at 14:24, Nick Kew wrote :
> > On Wed, 2016-06-08 at 08:01 -0400, Eric Covener wrote:
> >> On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
> >>> Then my question is, could it be possible ?
> >>
> >> You would need your own daemon launched during an early hook (like
> >> post_config). You wouldn't be able to respond [directly] to requests,
> >> you'd need to reach out over something like a pipe the way rewritemap
> >> does.
> >>
> > A hacked suexec would be a per-request option. Or using
> > solaris and mod_privileges might just possibly help with
> > more fine-grained escalation.
>
>Nick, thank you very much for your answer, and sorry for my late reply.
>
>I red suexec source code, it gave me some ideas :
>I could write my own setuid-ed program which would :
>- setuid(<user_id>)
>- only perform the needed tasks under <user>
>- exit
>This program could be then called from any other custom module etc...
Maybe esoteric, possibly off-topic for this precise thread, but would
mod-itk be potentially useful? I looked into it a few years back, it
*seemed* to do what was promised, but also carried a fairly major cpu-cycle
overhead. I didn't have time to try and refine implementation and never put
it into production...
Best -- Paul
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] root perms / rewritemap prg / module system()
Posted by Ben RUBSON <be...@gmail.com>.
On 2016-06-08 at 14:24, Nick Kew wrote :
> On Wed, 2016-06-08 at 08:01 -0400, Eric Covener wrote:
>> On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
>>> Then my question is, could it be possible ?
>>
>> You would need your own daemon launched during an early hook (like
>> post_config). You wouldn't be able to respond [directly] to requests,
>> you'd need to reach out over something like a pipe the way rewritemap
>> does.
>>
> A hacked suexec would be a per-request option. Or using
> solaris and mod_privileges might just possibly help with
> more fine-grained escalation.
Nick, thank you very much for your answer, and sorry for my late reply.
I red suexec source code, it gave me some ideas :
I could write my own setuid-ed program which would :
- setuid(<user_id>)
- only perform the needed tasks under <user>
- exit
This program could be then called from any other custom module etc...
Thank you again !
Ben
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] root perms / rewritemap prg / module system()
Posted by Nick Kew <ni...@apache.org>.
On Wed, 2016-06-08 at 08:01 -0400, Eric Covener wrote:
> On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
> > Then my question is, could it be possible ?
>
> You would need your own daemon launched during an early hook (like
> post_config). You wouldn't be able to respond [directly] to requests,
> you'd need to reach out over something like a pipe the way rewritemap
> does.
>
A hacked suexec would be a per-request option. Or using
solaris and mod_privileges might just possibly help with
more fine-grained escalation.
Bear in mind that anything running as root is, at the very least,
a big security concern, and I would NOT recommend the above
unless it was an alternative to something yet worse!
Rewritemap at least has the advantage of history and exposure.
--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] root perms / rewritemap prg / module system()
Posted by Ben RUBSON <be...@gmail.com>.
> On 8 jun 2016 at 14:01, Eric Covener :
>
> On Sat, Apr 16, 2016 at 6:00 PM, Ben RUBSON <be...@gmail.com> wrote:
>> Then my question is, could it be possible ?
>
> You would need your own daemon launched during an early hook (like
> post_config). You wouldn't be able to respond [directly] to requests,
> you'd need to reach out over something like a pipe the way rewritemap
> does.
Thank you Eric.
So it would not perform better/faster than a rewritemap.
Mmmmh OK :)
Thank you !
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org